Question
You have a Microsoft Foundry project named Project1 that contains the following:
- An OpenAPI tool that calls an external API
- A project connection named Connection1 that stores the API key of the external API
When an agent calls the OpenAPI tool, the API returns a 401 unauthorized error, and traces show that the API key header is NOT being sent.
You need to ensure that the OpenAPI tool automatically includes the API key from Connection1 on all requests.
What should you do?
- A. Enable identity passthrough so that the tool uses the Microsoft Entra token of the caller.
- B. Add the API key header manually to the OpenAPI specification.
- C. Configure the tool to use the default connection of Project1.
- D. Connect the tool to Connection1. Correct
Explanation
An OpenAPI tool gets its API key from a project connection, and the tool must reference that specific connection by its resource ID for the key to be added to requests. Identity passthrough sends a Microsoft Entra token, not the API key the external API expects. Adding the key header manually to the specification is wrong because the specification only declares the scheme, and any parameter carrying the key should be removed so the connection supplies it. A project default connection is not how the tool finds the key: it uses the connection it is explicitly linked to.
